Persist bounded mutable world state independently of compiled content

[zoeyrose]

Important

This issue is implemented in the fresh MIT-licensed Go server under the replacement program. Its gameplay and content-design decisions remain authoritative. C, CPython, classic packet, file-path, and enum details in the preserved specification are historical evidence only; do not copy, translate, or structurally port GPL implementation code.

Replacement implementation contract

Use SQLite transactions and bounded, versioned map-instance snapshots/deltas tied to an immutable compiled-content digest. The fresh server has no Flex loader; the issue owns persistence behavior, bounds, crash consistency, and version migration.

The server remains authoritative, consumes versioned compiled content, and exposes bounded generated Game Protocol 1 messages. Pure rules may use a specifically approved typed CEL environment. Starlark is not part of this issue unless the separate residual-scripting decision explicitly approves it.

Required verification

• Preserve every observable rule, balance decision, disclosure boundary, and anti-exploit invariant from the specification below.
• Add deterministic Go unit/property tests and wrapper-managed scenario coverage at the appropriate integration boundary.
• Add bounded malformed-input and persistence-failure cases where this feature accepts content, network, or stored data.
• Add Go/Rust protocol conformance fixtures for every new cross-process field; the client must not reconstruct authoritative rules from prose.
• Demonstrate that implementation and tests contain no copied GPL source/test material and execute no runtime Python.

Preserved product/design specification and historical implementation notes

Parent and roadmap

• Parent tracker: Proposal: adopt schema-driven map/archetype sources and compiled runtime caches atrinik#166
• Roadmap: Roadmap: replace classic Atrinik with a fresh MIT Go and Rust stack atrinik#168
• Roadmap milestone: M5
• Prerequisites: Adopt content-toolkit across the authored corpus and retire duplicate parsers content#8, Model structural surfaces and free-air elevation #12

Outcome

Separate authoritative mutable runtime state from reproducible compiled content with a versioned bounded snapshot codec, migration tooling, and final parser cleanup.

Scope

• Define ASNP framing and typed fields for inactive maps, player-unique maps, random/dynamic maps, unique items, generation/source identity, and reset metadata.
• Implement atomic writes, crash recovery, inspection, corruption diagnostics, and explicit size/nesting/object bounds.
• Provide a separately approved migration/inspection path for existing local runtime data; never rewrite it during build/test.
• Move all remaining temporary-map and object persistence consumers, then update docs and runtime skills.

Superseded path / cleanup target

Delete obsolete Flex object/map readers and writers only after authored sources and every mutable persistence consumer have migrated. Cache pruning must never touch snapshots.

Acceptance criteria

• Every supported mutable map/object lifecycle round-trips through bounded snapshots with current authoritative behavior.
• Corrupt/partial snapshots fail safely with recovery diagnostics and no cache confusion.
• Migration requires explicit operator action and preserves backup/rollback boundaries.
• No Flex loader or independent source/persistence parse path remains.

Validation baseline

Before: immutable authored parsing and authoritative mutable save data still share legacy text/Flex machinery.

After: compiled caches are disposable while bounded snapshots safely own mutable state.

Run snapshot boundary/corruption/crash tests, all special map/reset/unique workflows, migration dry runs on fixtures, server runtime checks, and Linux/MinGW builds.

This issue is a bounded child of atrinik/atrinik#166. The parent remains open until every sibling child is complete.